Command Injection

Pattern detected: from "node:child_process"

audio/scripts/audio.test.mjs:4

import { spawnSync } from "node:child_process";

Pattern detected: f"SELECT * FROM '{hf_path}' USING SAMPLE {n} (RESERVOIR, {seed}

scripts/sql_manager.py:262

sql = f"SELECT * FROM '{hf_path}' USING SAMPLE {n} (RESERVOIR, {seed})"

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: setTimeout(

scripts/oauth-setup.py:57

<script>setTimeout(function() { window.close(); }, 3000);</script>

Pattern detected: from 'node:child_process'

scripts/lib/cdp.mjs:4

import { spawn, spawnSync } from 'node:child_process';